Fix oc policy remove-user to remove rolebindings too

Followup to openshift#18102

Signed-off-by: Simo Sorce <[email protected]>

Author: simo5

pkg/oc/admin/policy/modify_roles.go

@@ -513,6 +513,12 @@ func (o *RoleModificationOptions) RemoveRole() error {
 		if err != nil {
 			return err
 		}
+		// Check that we update the rolebinding for the intended role.
+		if existingRoleBinding.RoleRef.Name != o.RoleName || existingRoleBinding.RoleRef.Namespace != o.RoleNamespace {
+			return fmt.Errorf("rolebinding %s contains role %s in namespace %s, instead of role %s in namespace %s",
+				o.RoleBindingName, existingRoleBinding.RoleRef.Name, existingRoleBinding.RoleRef.Namespace, o.RoleName, o.RoleNamespace)
+		}
+
 		roleBindings = make([]*authorizationapi.RoleBinding, 1)
 		roleBindings[0] = existingRoleBinding
 	} else {

pkg/oc/admin/policy/remove_from_project.go

@@ -176,7 +176,11 @@ func (o *RemoveFromProjectOptions) Run() error {
 		}
 
 		if !o.DryRun {
-			_, err = o.Client.RoleBindings(o.BindingNamespace).Update(&currBinding)
+			if len(currBinding.Subjects) > 0 {
+				_, err = o.Client.RoleBindings(o.BindingNamespace).Update(&currBinding)
+			} else {
+				err = o.Client.RoleBindings(o.BindingNamespace).Delete(currBinding.Name, &metav1.DeleteOptions{})
+			}
 			if err != nil {
 				return err
 			}

test/integration/policy_commands_test.go

@@ -4,6 +4,7 @@ import (
 	"io/ioutil"
 	"testing"
 
+	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	authorizationclient "github.com/openshift/origin/pkg/authorization/generated/internalclientset"
@@ -89,8 +90,10 @@ func TestPolicyCommands(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
+	// Check that the removal of the last subject caused the rolebinding to be
+	// removed as well
 	viewers, err = haroldAuthorizationClient.RoleBindings(projectName).Get("view", metav1.GetOptions{})
-	if err != nil {
+	if !errors.IsNotFound(err) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	binding = authorizationinterfaces.NewLocalRoleBindingAdapter(viewers)